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- The MAILING DATE of this communication appears on the cover sheet with the correspondence address - 



Period for Reply 

A SHORTENED STATUTORY PERIOD FOR REPLY IS SET TO EXPIRE 3 MONTH(S) FROM 
THE MAILING DATE OF THIS COMMUNICATION. 

- Extensions of time may be available under the provisions of 37 CFR 1 .136(a). In no event, however, may a reply be timely filed 
after SIX (6) MONTHS from the mailing date of this communication. 

- If the period for reply specified above is less than thirty (30) days, a reply within the statutory minimum of thirty (30) days will be considered timely. 

- If NO period for reply is specified above, the maximum statutory period will apply and will expire SIX (6) MONTHS from the mailing date of this communication. 

- Failure to reply within the set or extended period for reply will, by statute, cause the application to become ABANDONED (35 U.S.C. § 133). 
Any reply received by the Office later than three months after the mailing date of this communication, even if timely filed, may reduce any 
earned patent term adjustment. See 37 CFR 1.704(b). 

Status 

1 )S Responsive to communication(s) filed on 19 October 2000 . 
2a)D This action is FINAL. 2b)K This action is non-final. 

3) D Since this application is in condition for allowance except for formal matters, prosecution as to the merits is 

closed in accordance with the practice under Ex parte Quayle, 1935 CD. 1 1, 453 O.G. 213. 

Disposition of Claims 

4) [X] Claim(s) 1-33 is/are pending in the application. 

4a) Of the above claim(s) is/are withdrawn from consideration. 

5) D Claim(s) is/are allowed. 

6) IEI Claim(s) 1-33 is/are rejected. 

7) D Claim(s) is/are objected to. 

8) D Claim(s) are subject to restriction and/or election requirement. 

Application Papers 

9) D The specification is objected to by the Examiner. 

10)D The drawing(s) filed on is/are: a)D accepted or b)D objected to by the Examiner. 

Applicant may not request that any objection to the drawing(s) be held in abeyance. See 37 CFR 1 .85(a). 

Replacement drawing sheet(s) including the correction is required if the drawing(s) is objected to. See 37 CFR 1.121(d). 
1 1 )□ The oath or declaration is objected to by the Examiner. Note the attached Office Action or form PTO-152. 

Priority under 35 U.S.C. § 119 

12)D Acknowledgment is made of a claim for foreign priority under 35 U.S.C. § 119(a)-(d) or (f). 
a)D All b)D Some * c)D None of: 

1 .□ Certified copies of the priority documents have been received. 

2. Q Certified copies of the priority documents have been received in Application No. . 

3. D Copies of the certified copies of the priority documents have been received in this National Stage 

application from the International Bureau (PCT Rule 17.2(a)). 
* See the attached detailed Office action for a list of the certified copies not received. 
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DETAILED ACTION 

1 . The detail action is written in respond to the Amendment submitted on Jun 
1 st of 2004. 

2. Examiner accepts the submitted drawing on Jun 1 st of 2004. 

Claim Rejections - 35 USC § 103 

3. The following is a quotation of 35 U.S.C. 103(a) which forms the basis for all 
obviousness rejections set forth in this Office action: 

(a) A patent may not be obtained though the invention is not identically disclosesd or described as set 
forth in section 102 of this title, if the differences between the subject matter sought to be patented and 
the prior art are such that the subject matter as a whole would have been obvious at the time the 
invention was made to a person having ordinary skill in the art to which said subject matter pertains. 
Patentability shall not be negatived by the manner in which the invention was made. 

4. Claims 1-33 rejected under 35 U T S.C. 103(a) as being unpatentable over Chiu et 
al, US Patent No. 5101402, hereinafter "Chiu", in view of Dietz et al, US Patent No. 
6651099, hereinafter "Dietz". 

5. As per claims 1 and 18, Chiu discloses a method for providing a unique 
identification of monitored network data instances flowing across various connections 
between networked devices, the unique identification being derived from information 
contained entirely within each instance of the network data, the method comprising: 
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using at least one monitoring device to monitor a network data instance flowing across 
at least one data connection (Col 7 lines 15-39); deriving from the data instance certain 
information which collectively provides a unique identification (Col 9 lines 1-54) of the 
network data instance; However, Chiu does not discloses "assembling the derived 
information into an input string for a hash function; and using the output string of the 
hash function as a signature which represents a unique identifier of the network data 
instance". Nevertheless, the method of deriving the unique identifier using the hash 
function to create the signature is taught by Dietz in (Col 6 lines 18-19). Therefore, it 
would have obvious for one having ordinary skill in the art to incorporate the hash 
function to create the signature of the unique identification data captured by the Chiu's 
invention. The result is a unique identifier signature of the session or data instance in 
the network. This signature is unique and minimal in sizing, which can be easily stored 
and processed (Col 10 lines 53-60). 

6. As per claims 2, 7-9, and 24-26, Chiu discloses the method according to Claims 
1 and 18, wherein the deriving step includes: deriving from the data instance a source 
and destination address for the data; deriving from the data instance a source and 
destination port associated with the networked devices (Col 3 lines 24-40, Col 8 lines 
54-61 , and Col 9 lines 3-25) (The Transport layer header info has the ports info and The 
Link layer header info has the address info); deriving from the data instance at least one 
sequence number associated with data instance (Col 9 lines 33-45). 
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7. As per claims 3, 4, 15, 20-21, and 32, Chiu discloses the method according to 
Claims 1 and 18, which further includes: attaching the signature to at least one data 
report associated with the network data instance; and transmitting data reports and 
signatures from each monitoring device to a central collecting device (Col 12 lines 7- 
14). 



8. As per claims 5 and 22, Chiu disclose the method according to Claims 3 and 20, 
wherein the central collecting device uses the signatures to eliminate duplicate data 
reports that might come in from different monitoring devices positioned at different 
locations on the network (Col 12 lines 19-28). 



9. As per claims 6 and 23, Chiu discloses the method according to Claims 1 and 
18, wherein network data instances are data packets as part of a TCP/IP (Transmission 
Control Protocol/Internet Protocol) client-server network (Col 1 lines 13-24, and Col 2 
lines 24-39). 



10. As per claims 10 and 27, Chiu discloses the method according to Claims 9 and 
26, wherein the at least one sequence number includes both a client sequence number 
and a server sequence number (Col 9 lines 40-45, and Col 1 lines 17-24) (The 
sequence number cited is the number of packet sending back and forth by both ends). 
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11. As per claims 1 1 and 28, Chiu discloses the method according to Claims 2 and 
19, wherein the input string information does not include sequence numbers (Col 9 lines 
3-9). 

12. As per claims 12 and 29, Chiu discloses the method according to Claims 1 1 and 
28, wherein the network data instances are datagrams as part of a UDP/IP (User 
Datagram Protocol/Internet Protocol) network (Col 9 line 21) (The ACK is the UDP 
packet). 



13. As per claims 13 and 30, Chiu discloses the method according to Claims 1 and 
18. However, Neither Chiu or Dietz discloses "truncating the signature to include fewer 
bits than the hash function output string". Nevertheless, It would have been obvious at 
the time of the invention for one having ordinary skill in the art to reduce the output 
string to a fewer bits. This operation will obviously create a uniform unique signature for 
storage and processing purpose. 



14. As per claims 14 and 31 , Chiu discloses the method according to Claims 1 and 
18, which further includes: adding flag bits to the signature which indicate the type of 
application associated with the network data instance (Col 10 line 54-57). 

15. As per claim 16, Chiu discloses the method according to Claim 1, wherein the 
monitoring device operates to directly monitor the network data (Col 7 lines 15-27). 
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16. As per claim 17, Chiu discloses the method according to Claim 1, wherein the 
monitoring device operates to indirectly monitor the network data (Col 7 lines 15-27). 

1 7. As per claim 33, Chiu disclose method for providing a unique session key of 
monitored network data packets flowing across various connections between networked 
devices, the unique session key being derived from information contained entirely within 
each instance of the network data packet, the method comprising: using at least one 
monitoring device to monitor a network data packet flowing across at least one data 
connection (Col 12 lines 19-28); deriving from the data packet a source and destination 
address for the data is inherent in a TCP/IP network; deriving from the data packet a 
source and destination port associated with the networked devices is inherent in a 
TCP/IP network (Col 3 lines 24-40, Col 8 lines 54-61, and Col 9 lines 3-25) (The 
Transport layer header info has the ports info and The Link layer header info has the 
address info); deriving from the data packet at least one sequence number associated 
with data instance (Col 9 lines 33-45); attaching the unique session identifier to at least 
one data report associated with the network data packet (Col 12 lines 7-28); Chiu does 
use the hash function based on the current session key to access the session record 
which includes all the information derived above (Col 10 lines 18-23). However, "Chiu 
does not assembling the derived addresses, ports, and at least one sequence number 
information into an input string for a hash function; and using the output string of the 
hash function as the signature which represents a unique identifier of the network data 
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packet". Nevertheless, the method of deriving the unique identifier using the hash 
function to create the signature is taught by Dietz in (Col 6 lines 18-19). Therefore, it 
would have obvious for one having ordinary skill in the art to incorporate the hash 
function to create the signature of the unique identification data captured by the Chiu's 
invention. The result is a unique identifier signature of the session or data instance in 
the network. This signature is unique and minimal in sizing, which can be easily stored 
and processed (Col 10 lines 53-60). 

Conclusion 

18. Any inquiry concerning this communication from the examiner should be directed 
to Linh Son whose telephone number is (703)-305-8914. 

19. If attempts to reach the examiner by telephone are unsuccessful, the examiner's 
supervisor Kim Y. Vu can be reached at (703)-305-4393. The fax numbers for this 
group are (703)-872-9306 (official fax). Any inquiry of general nature or relating to the 
status of this application or proceeding should be directed to the group receptionist 
whose telephone number is (703)-305-9600. 

20. Please notice. Due to the Office moving, the telephone numbers above will only 
be valid until October 15 th of 2004. After that, the follow list of numbers will be valid: 

Examiner: (571)272-3856. 
KimY.Vu: (571)272-3859 



Application/Control Number: 09/693,798 



Page 8 



Art Unit: 2135 

Receptionist : (571) 272-2100 

21 . Information regarding the status of an application may be obtained from the 
Patent Application Information Retrieval IPAIR.I system. Status information for 
published applications may be obtained from either Private PMR or Public PMR. Status 
information for unpublished applications is available through Private PMR only. For 
more information about the PAIR system, see http://pzr-direct.uspto.gov. Should you 
have questions on access to the Private PAIR system, contact the Electronic Business 
Center (EBC) at 866-217-9197 (toll-free). 



Linh LD Son 
Patent Examiner 
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